Slashdot Mirror
Zero-Day IE Exploit Takes Control of PCs
anethema writes "A remote IE exploit with implementations is currently in the wild. From the article: 'Exploit code for a critical flaw in fully patched versions of Microsoft Corp.'s Internet Explorer browser has been released on the Internet, putting millions of Web surfers at risk of computer hijack attacks.' Aparently all you have to do is browse the page to be affected. There is no patch, but since it is a JavaScript exploit, you can work around it by disabling JavaScript."
I use Firefox.
Remember when web browsers were just for viewing HTML pages, and not as a platform agnostic instant-rollout applications platform?
Yeah, me neither.
From eWeek: The group that published the exploit said Microsoft has been aware of the Javascript Window() vulnerability for several months but was mistakenly treating it as a low-priority denial-of-service flaw.
Because anything that allows a malicious user to exploit your system and hijack isn't a flaw... it's a feature!
GetOuttaMySpace - The Anti-Social Network
Ah, the Firefox of Opera - who is that, Pavarotti?
I use netcat.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
Now that you've read the comments, your Windows box belongs to OSTG. Please stand by while we load Linux.........
This sig isn't original enough, it's time to come up with something witty...
Well, there might be no customer impact at this time, but seeing as the exploit is published now, can I ask you again in about 5 minutes?
Drag n' Drop DVD Recommendations
I don't browse the web.
Be a real patriot: Question authority. Think for yourself. Formulate your own conclusions.
/evil on
/evil off
That'd be SO funny
Someday, an IE exploit is going to come along that wipes your HD. Then we'll see sparks fly.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
This exploit exploits a vulnerability on a already found denial-of-service attack which Microsoft classified six months ago as "low-priority"...
Take Preinstalled Browser,
Add to Lazy User,
and mix in a healthy dose of Ignorance.
Alternate Receipe:
Take Preinstalled Browser,
Add Fear Of Change.
Despite having Firefox installed at home, my wife insists on MSExploder .... I think the linux migration time-table is getting shortened.
If you think imaginary property and real property are the same, when does your house become public domain?
Now, mod me whatever you want, but the info you provide should be FACTS.
Fact: A critical security flaw has been found in IE, and the SANS ISC is recommending that people use one of the "other browsers".
Howzat?
The opinion above is fiction. Any similarity to real opinions, including facts and logic, is purely coincidental.
Will DOS Firefox. Not as bad as an exploit but they have issues to fix as well.
users do, but they're much further down the food chain
Except that regular users comprimise a greater number of Internet users. So if Joe Average uses IE, more people are going to be affected by this flaw.
we'll get the usual set of arguments about browser and OS supremacy.
If something has fewer security problems, isn't it "superior" in that respect?
If you can't trust Lynx to be secure, then really nothing is secure.
Right. Because if something has one flaw, then you might as well not even bother trying, because everything has flaws. I mean, just because IE has had double-or-triple-digit flaws, clearly this one flaw in lynx makes all arguments against IE moot.
What an inane comment.
What, no link?
Here you can test an exploit on IE: http://www.computerterrorism.com/research/ie/poc.h tm
--
http://tvilda.stilius.net/
The holidays are a time for giving.
Now that you've RTFA, and you are now looking at the comments page, the staff of Slashdot and EWeek would like to thank you for visiting our web pages and giving us full control of your windows PCs.
Happy Holidays!
- Donny was a good bowler, and a good man.
I am pretty sure MS anti-spyware will stop this from launching
He who knows best knows how little he knows. - Thomas Jefferson
Isn't Google's master plan to take over the world dependent upon people using AJAX? If IE has a critical flaw using javascript, and everyone has to turn it off, then nobody will be able to use Google's new products and... Hey wait a minute.
Best. Comment. Ever. Enjoy!
but for the life of me I can't understand why.
It's very, very simple. People are stupid and lazy.
--- witty signature
To be honest, I found it more of a shock that Lynx has a security flaw.
Why? I haven't looked at Lynx recently, but Lynx used to be a very insecure
browser - Lynx code had lots & lots of Buffer Overflows.
Not affected. I've tested <body onload="window();"> and nothing happens besides JS console logging "Statement on line 1: The Object does not implement [[Call]]".
What he meant was that there were 4 ^W's and when you erase 4 words you wind up with the nonsensical statement in his post.
solution:
Buy sony cd,
install rootkit
rename Explorer to $sys$explorer.exe
The Code Ninja is swift with his tool, precise in his delivery, and deadly accurate in his execution.
So? When 90% of your "customers" are being told that they either turn off Javascript or get a virus, it doesn't matter whether the problem is with Javascript or IE - either way, there is no return for adding AJAX features to a web site. I'd rather spend my precious development resources on non-AJAX features that benefit everybody.
The next Cmdr Taco duplicate will be ready soon, but subscribers can beat the rush and see it early!
Despite having Firefox installed at home, my wife insists on MSExploder
I don't understand this. You aren't the first person to tell me their Wife doesn't wanna run Firefox. You know what I did. I said to my wife "Wife. IE will break the computer and then I will have to spend all night fixing it rather than doing whatever else it is you wanted me to do.". My wife actually respects that I know what the crap I am talking about (just as I respect what the crap she is talking about in her area of expertice...which isn't IT) and goes with what I say.
Why don't you people just try explaining the problems to your wife and get over it?
Unstable Apps: Our Android Apps Don't Suck